Linux Kernel vulnerabilities

CVE-2026-63805 [HIGH] CVE-2026-63805: In the Linux kernel, the following vulnerability has been resolved: crypto: nx - fix nx_crypto_ctx_ In the Linux kernel, the following vulnerability has been resolved: crypto: nx - fix nx_crypto_ctx_exit argument nx_crypto_ctx_shash_exit calls nx_crypto_ctx_exit with crypto_shash_ctx(...) but crypto_shash_ctx gives a nx_crypto_ctx *, not a crypto_tfm *. Fix the type in nx_crypto_ctx_exit and drop the bogus crypto_tfm_ctx call. This fixes the following oo

CVE-2026-46105 [HIGH] CVE-2026-46105: In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Limit NVMe reque In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Limit NVMe request size to 2 MiB The HBA firmware reports NVMe MDTS values based on the underlying drive capability. However, because the driver allocates a fixed 4K buffer for the PRP list, accommodating at most 512 entries, the driver supports a maximum I/O transfer size of

CVE-2026-46045 [HIGH] CWE-787 CVE-2026-46045: In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: skip reading rd In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: skip reading rdevs that are not in_sync When reading bitmap pages from member disks, the code iterates through all rdevs and attempts to read from the first available one. However, it only checks for raid_disk assignment and Faulty flag, missing the In_sync flag check

CVE-2026-31742 [HIGH] CWE-125 CVE-2026-31742: In the Linux kernel, the following vulnerability has been resolved: vt: discard stale unicode buffe In the Linux kernel, the following vulnerability has been resolved: vt: discard stale unicode buffer on alt screen exit after resize When enter_alt_screen() saves vc_uni_lines into vc_saved_uni_lines and sets vc_uni_lines to NULL, a subsequent console resize via vc_do_resize() skips reallocating the unicode buffer because vc_uni_lines is NULL. Howeve

CVE-2026-23280 [HIGH] CVE-2026-23280: In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Prevent ubuf siz In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Prevent ubuf size overflow The ubuf size calculation may overflow, resulting in an undersized allocation and possible memory corruption. Use check_add_overflow() helpers to validate the size calculation before allocation.

CVE-2026-46280 [HIGH] CWE-416 CVE-2026-46280: In the Linux kernel, the following vulnerability has been resolved: lib: test_hmm: evict device pag In the Linux kernel, the following vulnerability has been resolved: lib: test_hmm: evict device pages on file close to avoid use-after-free Patch series "Minor hmm_test fixes and cleanups". Two bugfixes a cleanup for the HMM kernel selftests. These were mostly reported by Zenghui Yu with special thanks to Lorenzo for analysing and pointing out the p

CVE-2026-45956 [HIGH] CWE-416 CVE-2026-45956: In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: use priv->vid In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() vidi_connection_ioctl() retrieves the driver_data from drm_dev->dev to obtain a struct vidi_context pointer. However, drm_dev->dev is the exynos-drm master device, and the driver_data contained therein is

CVE-2026-45970 [HIGH] CWE-416 CVE-2026-45970: In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix UAF in rlb_ar In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix UAF in rlb_arp_recv during bond up/down The ALB RX path may access rx_hashtbl concurrently with bond teardown. During rapid bond up/down cycles, rlb_deinitialize() frees rx_hashtbl while RX handlers are still running, leading to a null pointer dereference detected b

CVE-2026-31584 [HIGH] CWE-416 CVE-2026-31584: In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: fix us In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: fix use-after-free in encoder release path The fops_vcodec_release() function frees the context structure (ctx) without first cancelling any pending or running work in ctx->encode_work. This creates a race window where the workqueue handler (mtk_venc_worker)

CVE-2026-31500 [HIGH] CWE-416 CVE-2026-31500: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: serialize b In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock btintel_hw_error() issues two __hci_cmd_sync() calls (HCI_OP_RESET and Intel exception-info retrieval) without holding hci_req_sync_lock(). This lets it race against hci_dev_do_close() -> btintel_shutdown_combine

CVE-2026-23336 [HIGH] CWE-416 CVE-2026-23336: In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel rfkill_b In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() There is a use-after-free error in cfg80211_shutdown_all_interfaces found by syzkaller: BUG: KASAN: use-after-free in cfg80211_shutdown_all_interfaces+0x213/0x220 Read of size 8 at addr ffff888112a78d98 by task kworker/0

CVE-2025-71075 [HIGH] CWE-416 CVE-2025-71075: In the Linux kernel, the following vulnerability has been resolved: scsi: aic94xx: fix use-after-fr In the Linux kernel, the following vulnerability has been resolved: scsi: aic94xx: fix use-after-free in device removal path The asd_pci_remove() function fails to synchronize with pending tasklets before freeing the asd_ha structure, leading to a potential use-after-free vulnerability. When a device removal is triggered (via hot-unplug or module un

CVE-2026-46319 [HIGH] CWE-416 CVE-2026-46319: In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: Only release In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: Only release RCU read lock after ct_ft When looking up a flow table in act_ct in tcf_ct_flow_table_get(), rhashtable_lookup_fast() internally opens and closes an RCU read critical section before returning ct_ft. The tcf_ct_flow_table_cleanup_work() can complete bef

CVE-2026-46246 [HIGH] CWE-416 CVE-2026-46246: In the Linux kernel, the following vulnerability has been resolved: power: supply: pm8916_lbc: Fix In the Linux kernel, the following vulnerability has been resolved: power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `extcon` handle, means that the `extcon` handle will be deallocated/unregistered _before_ the interrupt hand

CVE-2026-43016 [HIGH] CWE-416 CVE-2026-43016: In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: Fix use-after-fre In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). syzbot reported use-after-free of AF_UNIX socket's sk->sk_socket in sk_psock_verdict_data_ready(). [0] In unix_stream_sendmsg(), the peer socket's ->sk_data_ready() is called after dropping its unix_

CVE-2026-23351 [HIGH] CWE-416 CVE-2026-23351: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: spli In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase Yiming Qian reports Use-after-free in the pipapo set type: Under a large number of expired elements, commit-time GC can run for a very long time in a non-preemptible context, triggering soft lockup warnings and RCU sta

CVE-2026-23273 [HIGH] CWE-416 CVE-2026-23273: In the Linux kernel, the following vulnerability has been resolved: macvlan: observe an RCU grace p In the Linux kernel, the following vulnerability has been resolved: macvlan: observe an RCU grace period in macvlan_common_newlink() error path valis reported that a race condition still happens after my prior patch. macvlan_common_newlink() might have made @dev visible before detecting an error, and its caller will directly call free_netdev(dev).

CVE-2026-43388 [HIGH] CWE-416 CVE-2026-43388: In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: clear walk_contr In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: clear walk_control on inactive context in damos_walk() damos_walk() sets ctx->walk_control to the caller-provided control structure before checking whether the context is running. If the context is inactive (damon_is_running() returns false), the function returns -EINV

CVE-2026-31532 [HIGH] CWE-416 CVE-2026-31532: In the Linux kernel, the following vulnerability has been resolved: can: raw: fix ro->uniq use-afte In the Linux kernel, the following vulnerability has been resolved: can: raw: fix ro->uniq use-after-free in raw_rcv() raw_release() unregisters raw CAN receive filters via can_rx_unregister(), but receiver deletion is deferred with call_rcu(). This leaves a window where raw_rcv() may still be running in an RCU read-side critical section after raw_re

CVE-2026-31419 [HIGH] CWE-416 CVE-2026-31419: In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-fre In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clones it for others. Concurrent slave enslave/release can mutate the slave list during RCU-protected iteration, changin